6

Currently, SE allows user to embed arbitrary images (from HTTPS sources) into posts and into comments in chat. The consequence of this is that whoever controls the server those images are hosted on can track visits to the page the image is embedded.

While the IP address and browser user agent alone might not be personal information, especially in chat it is likely that someone could connect those to SE users.

According to the privacy policy, when SE intentionally shares data with external providers, they require those to sign an agreement on how to handle that data. There is no such agreement with random image hosts that any user could embed in posts.

This is not a new concern, there have been several meta posts about this issue before:

There are also more than just these privacy issues with allowing image embedding from other sources like those images becoming unavailable after a while.

SE has a useable internal image hosting feature for many years now, there is no need to still allow users to embed images from other sources, given the potential issues with this.

Handling the existing embedded images is a bit more tricky. Converting them into plain links without embedding the images is probably the easiest way to handle this without too much effort.

I'm not a lawyer, I don't have the necessary knowledge to decide whether this is an issue according to the GDPR. But with the recent focus on data collection and handling I think it makes sense to revisit it, and maybe just to fix this even if does not violate the letter of the law after all.

Improve this question
9
  • 1
    Many companies and even whole countries block imgur.com domain, including SE dedicated sub domain. This can't be changed. So having the option to post link to image hosted elsewhere gives a chance for those people to see images. It's not rare, I suspect it's many thousands of people. IMO, if someone is so paranoid about privacy, they can just disable all images (any modern browser has this option afaik), or use browser extension to block images/resources from specific list. (Or use white list)
    – Shadow Wizard
    Commented Jun 3, 2018 at 12:36
  • imgur.com/privacy seems to be pretty comprehensive ...
    – DavidPostill
    Commented Jun 3, 2018 at 12:47
  • @DavidPostill well, OP here doesn't mean images hosted on imgur, but rather elsewhere.
    – Shadow Wizard
    Commented Jun 3, 2018 at 12:52
  • 2
    @ShadowWizard the real solution to that would be hosting images on SE domains, which might not be entirely impossible now that Teams has an internal image hosting option. The vast majority of images are on the imgur host, I don't see how hosting a tiny minority of images somewhere else provides much benefit to users where imgur is blocked, they still can't see all the other images.
    – Mad Scientist
    Commented Jun 3, 2018 at 13:34
  • 1
    I wonder is this a real problem for other sites with user generated content? A good many traditional forums would... probably have a big problem if it was. And I'd suspect the external sources would need to worry about the gdpr, if SE didn't actually actively or passively get any data from it. Also, being able to embed semi arbitratry content is how the internet works.
    – Journeyman Geek
    Commented Jun 3, 2018 at 14:40
  • 2
    Using CSP to limit the data in referals might help to reduce the amount of information that is exposed, but it wouldn't help with sending a picture to a single user, and then linking the request to that user.
    – jrtapsell
    Commented Jun 3, 2018 at 14:59
  • 2
    TIL GDPR bans hyperlinks.
    – user1228
    Commented Jun 3, 2018 at 18:56
  • 2
    @Won't hyperlinks you click on, and then you submit information to the target site. That's a choice the user makes (if the target is not obscured in any way). Embedded content from other sites doesn't give the user a choice, that's something different.
    – Mad Scientist
    Commented Jun 3, 2018 at 19:15
  • It's also an extremely important feature for the whole WWW thingy, so...
    – user1228
    Commented Jun 4, 2018 at 13:14

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .